CVE-2026-62088

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-62088

The ElasticPress WordPress plugin (by 10up), versions through 5.3.4 , is affected by a Sensitive Data Exposure vulnerability classified as Insertion of Sensitive Information Into Sent Data. An unauthenticated remote attacker can retrieve embedded sensitive data, with a CVSS v3.1 score of 5.3 (Med...

EUVD-2026-76191

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-62088: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

PT-2026-90042

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-25311: Missing Authorization

Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoshare for Twitter: from n/a through = 2.3.1...

CVE-2025-67621: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through = 1.2.5...

EUVD-2024-35443

Malicious code in bioql PyPI...

Malicious code in eslint-config-10up (npm)

The package eslint-config-10up was found to contain malicious code...

MAL-2025-19823 Malicious code in eslint-config-10up (npm)

The package eslint-config-10up was found to contain malicious code...

CVE-2023-32798: Missing Authorization

Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0...

CVE-2024-43116

Cross-Site Request Forgery CSRF vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10...

CVE-2024-43116 WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10...

CVE-2024-43116

CVE-2024-43116: CSRF vulnerability in WordPress Simple Local Avatars plugin (

CVE-2024-43116: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10...

CVE-2024-35684

Cross-Site Request Forgery CSRF vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through = 5.1.1...

CVE-2024-35684 WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through = 5.1.1...

CVE-2024-35684

Technical details about CVE-2024-35684 (ElasticPress CSRF) are not publicly provided in the supplied documents. No affected versions, exploit info, or fixes are specified here; monitor for official advisories.